refactor(state): merge parameter and link security (#7200)

Author: soyuka

src/Metadata/Exception/AccessDeniedException.php

@@ -0,0 +1,29 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Metadata\Exception;
+
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+
+final class AccessDeniedException extends AccessDeniedHttpException implements HttpExceptionInterface
+{
+    public function getStatusCode(): int
+    {
+        return 403;
+    }
+
+    public function getHeaders(): array
+    {
+        return [];
+    }
+}

src/Metadata/HttpOperation.php

@@ -349,6 +349,9 @@ public function getUriVariables()
         return $this->uriVariables;
     }
 
+    /**
+     * @param array<string, mixed>|array<int, Link>|list<string> $uriVariables
+     */
     public function withUriVariables($uriVariables): static
     {
         $self = clone $this;

src/Metadata/Link.php

@@ -14,6 +14,7 @@
 namespace ApiPlatform\Metadata;
 
 use ApiPlatform\OpenApi;
+use Symfony\Component\TypeInfo\Type;
 
 #[\Attribute(\Attribute::TARGET_PROPERTY | \Attribute::TARGET_METHOD | \Attribute::TARGET_PARAMETER)]
 final class Link extends Parameter
@@ -27,7 +28,8 @@ public function __construct(
         private ?array $identifiers = null,
         private ?bool $compositeIdentifier = null,
         private ?string $expandedValue = null,
-        ?string $security = null,
+
+        string|\Stringable|null $security = null,
         ?string $securityMessage = null,
         private ?string $securityObjectName = null,
 
@@ -37,9 +39,15 @@ public function __construct(
         mixed $provider = null,
         mixed $filter = null,
         ?string $property = null,
+        ?array $properties = null,
         ?string $description = null,
         ?bool $required = null,
         array $extraProperties = [],
+
+        mixed $constraints = null,
+        array|string|null $filterContext = null,
+        ?Type $nativeType = null,
+        ?bool $castToArray = null,
     ) {
         // For the inverse property shortcut
         if ($this->parameterName && class_exists($this->parameterName)) {
@@ -53,11 +61,16 @@ public function __construct(
             provider: $provider,
             filter: $filter,
             property: $property,
+            properties: $properties,
             description: $description,
             required: $required,
+            constraints: $constraints,
             security: $security,
             securityMessage: $securityMessage,
-            extraProperties: $extraProperties
+            extraProperties: $extraProperties,
+            filterContext: $filterContext,
+            nativeType: $nativeType,
+            castToArray: $castToArray,
         );
     }
 

src/Metadata/Parameter.php

@@ -133,6 +133,12 @@ public function getValue(mixed $default = new ParameterNotFound()): mixed
         return $this->extraProperties['_api_values'] ?? $default;
     }
 
+    /**
+     * Only use this in a parameter provider, the ApiPlatform\State\Provider\ParameterProvider
+     * resets this value to extract the correct value on each request.
+     * It's also possible to set the `_api_query_parameters` request attribute directly and
+     * API Platform will extract the value from there.
+     */
     public function setValue(mixed $value): static
     {
         $this->extraProperties['_api_values'] = $value;

src/State/ParameterProvider/IriConverterParameterProvider.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\ParameterProvider;
+
+use ApiPlatform\Metadata\IriConverterInterface;
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\Metadata\Parameter;
+use ApiPlatform\State\ParameterNotFound;
+use ApiPlatform\State\ParameterProviderInterface;
+
+/**
+ * @experimental
+ *
+ * @author Vincent Amstoutz
+ */
+final readonly class IriConverterParameterProvider implements ParameterProviderInterface
+{
+    public function __construct(
+        private IriConverterInterface $iriConverter,
+    ) {
+    }
+
+    public function provide(Parameter $parameter, array $parameters = [], array $context = []): ?Operation
+    {
+        $operation = $context['operation'] ?? null;
+        if (!($value = $parameter->getValue()) || $value instanceof ParameterNotFound) {
+            return $operation;
+        }
+
+        $iriConverterContext = ['fetch_data' => $parameter->getExtraProperties()['fetch_data'] ?? false];
+
+        if (\is_array($value)) {
+            $entities = [];
+            foreach ($value as $v) {
+                $entities[] = $this->iriConverter->getResourceFromIri($v, $iriConverterContext);
+            }
+
+            $parameter->setValue($entities);
+
+            return $operation;
+        }
+
+        $parameter->setValue($this->iriConverter->getResourceFromIri($value, $iriConverterContext));
+
+        return $operation;
+    }
+}

src/State/ParameterProvider/ReadLinkParameterProvider.php

@@ -0,0 +1,130 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <[email protected]>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\State\ParameterProvider;
+
+use ApiPlatform\Metadata\GraphQl\Operation as GraphQlOperation;
+use ApiPlatform\Metadata\HttpOperation;
+use ApiPlatform\Metadata\Link;
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\Metadata\Parameter;
+use ApiPlatform\Metadata\Resource\Factory\ResourceMetadataCollectionFactoryInterface;
+use ApiPlatform\State\Exception\ProviderNotFoundException;
+use ApiPlatform\State\ParameterProviderInterface;
+use ApiPlatform\State\ProviderInterface;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+/**
+ * Checks if the linked resources have security attributes and prepares them for access checking.
+ *
+ * @experimental
+ */
+final class ReadLinkParameterProvider implements ParameterProviderInterface
+{
+    /**
+     * @param ProviderInterface<object> $locator
+     */
+    public function __construct(
+        private readonly ProviderInterface $locator,
+        private readonly ResourceMetadataCollectionFactoryInterface $resourceMetadataCollectionFactory,
+    ) {
+    }
+
+    public function provide(Parameter $parameter, array $parameters = [], array $context = []): ?Operation
+    {
+        $operation = $context['operation'];
+        $extraProperties = $parameter->getExtraProperties();
+
+        if ($parameter instanceof Link) {
+            $linkClass = $parameter->getFromClass() ?? $parameter->getToClass();
+            $securityObjectName = $parameter->getSecurityObjectName() ?? $parameter->getToProperty() ?? $parameter->getFromProperty();
+        }
+
+        $securityObjectName ??= $parameter->getKey();
+
+        $linkClass ??= $extraProperties['resource_class'] ?? $operation->getClass();
+
+        if (!$linkClass) {
+            return $operation;
+        }
+
+        $linkOperation = $this->resourceMetadataCollectionFactory
+            ->create($linkClass)
+            ->getOperation($operation->getExtraProperties()['parent_uri_template'] ?? $extraProperties['uri_template'] ?? null);
+
+        $value = $parameter->getValue();
+
+        if (\is_array($value) && array_is_list($value)) {
+            $relation = [];
+
+            foreach ($value as $v) {
+                try {
+                    $relation[] = $this->locator->provide($linkOperation, $this->getUriVariables($v, $parameter, $linkOperation), $context);
+                } catch (ProviderNotFoundException) {
+                }
+            }
+        } else {
+            try {
+                $relation = $this->locator->provide($linkOperation, $this->getUriVariables($value, $parameter, $linkOperation), $context);
+            } catch (ProviderNotFoundException) {
+                $relation = null;
+            }
+        }
+
+        $parameter->setValue($relation);
+
+        if (null === $relation && true === ($extraProperties['throw_not_found'] ?? true)) {
+            throw new NotFoundHttpException('Relation for link security not found.');
+        }
+
+        $context['request']?->attributes->set($securityObjectName, $relation);
+
+        return $operation;
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function getUriVariables(mixed $value, Parameter $parameter, Operation $operation): array
+    {
+        $extraProperties = $parameter->getExtraProperties();
+
+        if ($operation instanceof HttpOperation) {
+            $links = $operation->getUriVariables();
+        } elseif ($operation instanceof GraphQlOperation) {
+            $links = $operation->getLinks();
+        } else {
+            $links = [];
+        }
+
+        if (!\is_array($value)) {
+            $uriVariables = [];
+
+            foreach ($links as $key => $link) {
+                if (!\is_string($key)) {
+                    $key = $link->getParameterName() ?? $extraProperties['uri_variable'] ?? $link->getFromProperty();
+                }
+
+                if (!$key || !\is_string($key)) {
+                    continue;
+                }
+
+                $uriVariables[$key] = $value;
+            }
+
+            return $uriVariables;
+        }
+
+        return $value;
+    }
+}